UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Audit records should contain required information.


Overview

Finding ID Version Rule ID IA Controls Severity
V-15646 DG0145-SQLServer9 SV-24109r2_rule ECAR-1 ECAR-2 ECAR-3 Medium
Description
Complete forensically valuable data may be unavailable or accountability may be jeopardized when audit records do not contain sufficient information.
STIG Date
Microsoft SQL Server 2005 Instance Security Technical Implementation Guide 2015-06-16

Details

Check Text ( C-22856r2_chk )
If C2 Auditing is enabled (See Check DM0510: C2 audit mode), this check is Not a Finding.

Determine the SQL Server Edition:

From the query prompt:

SELECT CONVERT(INT, SERVERPROPERTY('EngineEdition'))

If value returned is 1 (Personal or Desktop Edition) or 4 (Express Edition), if auditing is not enabled or not configured completely to requirements, review the System Security Plan. If this is properly explained in the System Security Plan, this is Not a Finding. If this is not documented or documented poorly in the System Security Plan, this is a Finding.

If value returned is 2 (Standard Edition) or 3 (Enterprise/Developer Edition), findings in all steps apply.

Note: Complete all checks to determine final Finding results.

1. Check to see that all required events are being audited

From the query prompt:

SELECT DISTINCT traceid FROM ::FN_TRACE_GETINFO('0')

All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a Finding.

2. For each traceid listed, replacing # with a traceid

From the query prompt:

SELECT DISTINCT(eventid) FROM ::FN_TRACE_GETEVENTINFO('#')

The required eventid’s 14, 15, 18, 20, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 115, 116, 117, 118, 128, 129, 130, 131, 132, 133, 134, 135, 152, 153, 170, 171, 172, 173, 175, 176, 177 and 178 should be listed.

If any of the audit events or eventid’s required above are not listed, this is a Finding.

3. Check to see that auditing is set to shutdown the database system if auditing fails (For each traceid listed, replacing # with a traceid)

From the query prompt:

SELECT CAST(value AS INT) FROM ::FN_TRACE_GETINFO('#')
WHERE property = 1 AND value > 4

If value returned is not greater than 4 for any traceid, this is a Finding.
Fix Text (F-19762r1_fix)
Create and start an audit trace that audits required events.

CREATE PROCEDURE fso_audit AS

-- Create a Queue

DECLARE @rc INT
DECLARE @TraceID INT
DECLARE @maxfilesize BIGINT
DECLARE @fso_audit_log NVARCHAR(128)

SET @maxfilesize = 5

-- Define custom @fso_audit_log to path\filename

SET @fso_audit_log = 'd:\sqlserver\audit\fsoauditlog.log'

EXEC @rc = SP_TRACE_CREATE @TraceID output, 6, @fso_audit_log, @maxfilesize, NULL

IF (@rc != 0) GOTO Error

-- Client side File and Table cannot be scripted.
-- Set the events:

DECLARE @on BIT

SET @on = 1

-- Logins are audited based on SQL Server instance
-- setting Audit Level stored in registry
-- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL.[#]\MSSQLServer\AuditLevel

-- Audit Login
-- Occurs when a user successfully logs in to SQL Server.

EXEC SP_TRACE_SETEVENT @TraceID, 14, 1, @on -- TextData
EXEC SP_TRACE_SETEVENT @TraceID, 14, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 14, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 14, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 14, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 14, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 14, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 14, 64, @on -- SessionLoginName

-- Audit Logout
-- Occurs when a user logs out of SQL Server.

EXEC SP_TRACE_SETEVENT @TraceID, 15, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 15, 13, @on -- Duration
EXEC SP_TRACE_SETEVENT @TraceID, 15, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 15, 15, @on -- EndTime
EXEC SP_TRACE_SETEVENT @TraceID, 15, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 15, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 15, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 15, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 15, 64, @on -- SessionLoginName


-- Audit Server Starts and Stops
-- Occurs when the SQL Server service state is modified.

EXEC SP_TRACE_SETEVENT @TraceID, 18, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 18, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 18, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 18, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 18, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 18, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 18, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 18, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 18, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 18, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 18, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 18, 64, @on -- SessionLoginName

-- Audit Login Failed
-- Indicates that a login attempt to SQL Server from a client failed.

EXEC SP_TRACE_SETEVENT @TraceID, 20, 1, @on -- TextData
EXEC SP_TRACE_SETEVENT @TraceID, 20, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 20, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 20, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 20, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 31, @on -- Error
EXEC SP_TRACE_SETEVENT @TraceID, 20, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 20, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 20, 64, @on -- SessionLoginName


-- Audit Statement GDR Event
-- Occurs every time a GRANT, DENY, REVOKE for a statement
-- permission is issued by any user in SQL Server.

EXEC SP_TRACE_SETEVENT @TraceID, 102, 1, @on -- TextData
EXEC SP_TRACE_SETEVENT @TraceID, 102, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 102, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 102, 19, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 102, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 102, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 28, @on -- ObjectType
EXEC SP_TRACE_SETEVENT @TraceID, 102, 34, @on -- ObjectName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 37, @on -- OwnerName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 39, @on -- TargetUserName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 40, @on -- DBUserName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 102, 42, @on -- TargetLoginName
EXEC SP_TRACE_SETEVENT @TraceID, 102, 43, @on -- TargetLoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 102, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 102, 64, @on -- SessionLoginName

-- Audit Object GDR Event
-- Occurs every time a GRANT, DENY, REVOKE for an object
-- permission is issued by any user in SQL Server.

EXEC SP_TRACE_SETEVENT @TraceID, 103, 1, @on -- TextData
EXEC SP_TRACE_SETEVENT @TraceID, 103, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 103, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 103, 19, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 103, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 103, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 28, @on -- ObjectType
EXEC SP_TRACE_SETEVENT @TraceID, 103, 34, @on -- ObjectName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 37, @on -- OwnerName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 39, @on -- TargetUserName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 40, @on -- DBUserName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 103, 42, @on -- TargetLoginName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 43, @on -- TargetLoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 103, 44, @on -- ColumnPermissions
EXEC SP_TRACE_SETEVENT @TraceID, 103, 59, @on -- ParentName
EXEC SP_TRACE_SETEVENT @TraceID, 103, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 103, 64, @on -- SessionLoginName

-- Audit AddLogin Event
-- Occurs when a SQL Server login is added or removed;
-- for sp_addlogin and sp_droplogin.

EXEC SP_TRACE_SETEVENT @TraceID, 104, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 104, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 104, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 104, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 104, 42, @on -- TargetLoginName
EXEC SP_TRACE_SETEVENT @TraceID, 104, 43, @on -- TargetLoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 104, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 104, 64, @on -- SessionLoginName

-- Audit Login GDR Event
-- Occurs when a Windows login right is added or removed;
-- for sp_grantlogin, sp_revokelogin, and sp_denylogin.

EXEC SP_TRACE_SETEVENT @TraceID, 105, 6, @on -- NTUserName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 7, @on -- NTDomainName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 8, @on -- HostName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 10, @on -- ApplicationName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 11, @on -- LoginName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 12, @on -- SPID
EXEC SP_TRACE_SETEVENT @TraceID, 105, 14, @on -- StartTime
EXEC SP_TRACE_SETEVENT @TraceID, 105, 23, @on -- Success
EXEC SP_TRACE_SETEVENT @TraceID, 105, 26, @on -- ServerName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 35, @on -- DatabaseName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 41, @on -- LoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 105, 42, @on -- TargetLoginName
EXEC SP_TRACE_SETEVENT @TraceID, 105, 43, @on -- TargetLoginSid
EXEC SP_TRACE_SETEVENT @TraceID, 105, 60, @on -- IsSystem
EXEC SP_TRACE_SETEVENT @TraceID, 105, 64, @on -- SessionLoginName

-- Audit Login Change Property Event
-- Occurs when a property of a login, except passwords,
-- is modified; for sp_defaultdb and sp_defaultlanguage.

EXEC SP_TRACE_SETEVENT @TraceID, 106, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 106, 64, @on

-- Audit Login Change Password Event
-- Occurs when a SQL Server login password is changed.
-- Passwords are not recorded.

EXEC SP_TRACE_SETEVENT @TraceID, 107, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 107, 64, @on

-- Audit Add Login to Server Role Event
-- Occurs when a login is added or removed from a fixed server role;
-- for sp_addsrvrolemember, and sp_dropsrvrolemember.

EXEC SP_TRACE_SETEVENT @TraceID, 108, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 38, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 108, 64, @on

-- Audit Add DB User Event
-- Occurs when a login is added or removed as a database user
-- (Windows or SQL Server) to a database; for sp_grantdbaccess,
-- sp_revokedbaccess, sp_adduser, and sp_dropuser.

EXEC SP_TRACE_SETEVENT @TraceID, 109, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 21, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 38, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 44, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 51, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 109, 64, @on

-- Audit Add Member to DB Role Event
-- Occurs when a login is added or removed as a database user
-- (fixed or user-defined) to a database; for sp_addrolemember,
-- sp_droprolemember, and sp_changegroup.

EXEC SP_TRACE_SETEVENT @TraceID, 110, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 38, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 110, 64, @on

-- Audit Add Role Event
-- Occurs when a login is added or removed as a database user to a
-- database; for sp_addrole and sp_droprole.

EXEC SP_TRACE_SETEVENT @TraceID, 111, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 38, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 111, 64, @on

-- Audit App Role Change Password Event
-- Occurs when a password of an application role is changed.

EXEC SP_TRACE_SETEVENT @TraceID, 112, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 38, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 112, 64, @on

-- Audit Statement Permission Event
-- Occurs when a statement permission (such as CREATE TABLE) is used.

EXEC SP_TRACE_SETEVENT @TraceID, 113, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 19, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 113, 64, @on

-- Audit Backup/Restore Event
-- Occurs when a BACKUP or RESTORE command is issued.

EXEC SP_TRACE_SETEVENT @TraceID, 115, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 115, 64, @on

-- Audit DBCC Event
-- Occurs when DBCC commands are issued.

EXEC SP_TRACE_SETEVENT @TraceID, 116, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 44, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 116, 64, @on

-- Audit Change Audit Event
-- Occurs when audit trace modifications are made.

EXEC SP_TRACE_SETEVENT @TraceID, 117, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 44, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 117, 64, @on

-- Audit Object Derived Permission Event
-- Occurs when a CREATE, ALTER, and DROP object commands are issued.

EXEC SP_TRACE_SETEVENT @TraceID, 118, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 118, 64, @on

-- Audit Database Management Event
-- Occurs when a CREATE, ALTER, or DROP statement executes on
-- database objects, such as schemas.

EXEC SP_TRACE_SETEVENT @TraceID, 128, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 128, 64, @on

-- Audit Database Object Management Event
-- Occurs when a CREATE, ALTER, or DROP statement executes on
-- database objects, such as schemas.

EXEC SP_TRACE_SETEVENT @TraceID, 129, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 129, 64, @on

-- Audit Database Principal Management Event
-- Occurs when principals, such as users, are created, altered, or
-- dropped from a database.

EXEC SP_TRACE_SETEVENT @TraceID, 130, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 130, 64, @on

-- Audit Schema Object Management Event
-- Occurs when server objects are created, altered, or dropped.

EXEC SP_TRACE_SETEVENT @TraceID, 131, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 59, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 131, 64, @on

-- Audit Server Principal Impersonation Event
-- Occurs when there is an impersonation within server scope, such
-- as EXECUTE AS LOGIN.

EXEC SP_TRACE_SETEVENT @TraceID, 132, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 132, 64, @on

-- Audit Database Principal Impersonation Event
-- Occurs when an impersonation occurs within the database scope,
-- such as EXECUTE AS USER or SETUSER.

EXEC SP_TRACE_SETEVENT @TraceID, 133, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 38, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 133, 64, @on

-- Audit Server Object Take Ownership Event
-- Occurs when the owner is changed for objects in server scope.

EXEC SP_TRACE_SETEVENT @TraceID, 134, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 134, 64, @on

-- Audit Database Object Take Ownership Event
-- Occurs when a change of owner for objects within database scope
-- occurs.

EXEC SP_TRACE_SETEVENT @TraceID, 135, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 135, 64, @on

-- Audit Change Database Owner
-- Occurs when ALTER AUTHORIZATION is used to change the owner of a
-- database and permissions are checked to do that.

EXEC SP_TRACE_SETEVENT @TraceID, 152, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 152, 64, @on

-- Audit Schema Object Take Ownership Event
-- Occurs when ALTER AUTHORIZATION is used to assign an owner to an
-- object and permissions are checked to do that.

EXEC SP_TRACE_SETEVENT @TraceID, 153, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 59, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 153, 64, @on

-- Audit Server Scope GDR Event
-- Indicates that a grant, deny, or revoke event for permissions in
-- server scope occurred, such as creating a login.

EXEC SP_TRACE_SETEVENT @TraceID, 170, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 19, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 170, 64, @on

-- Audit Server Object GDR Event
-- Indicates that a grant, deny, or revoke event for a schema object,
-- such as a table or function, occurred.

EXEC SP_TRACE_SETEVENT @TraceID, 171, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 19, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 171, 64, @on

-- Audit Database Object GDR Event
-- Indicates that a grant, deny, or revoke event for database
-- objects, such as assemblies and schemas, occurred.

EXEC SP_TRACE_SETEVENT @TraceID, 172, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 19, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 172, 64, @on

-- Audit Server Operation Event
-- Occurs when Security Audit operations such as altering settings,
-- resources, external access, or authorization are used.

EXEC SP_TRACE_SETEVENT @TraceID, 173, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 173, 64, @on

-- Audit Server Alter Trace Event
-- Occurs when a statement checks for the ALTER TRACE permission.

EXEC SP_TRACE_SETEVENT @TraceID, 175, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 175, 64, @on

-- Audit Server Object Management Event
-- Occurs when server objects are created, altered, or dropped.

EXEC SP_TRACE_SETEVENT @TraceID, 176, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 45, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 46, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 176, 64, @on

-- Audit Server Principal Management Event
-- Occurs when server principals are created, altered, or dropped.

EXEC SP_TRACE_SETEVENT @TraceID, 177, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 39, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 42, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 43, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 45, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 177, 64, @on

-- Audit Database Operation Event
-- Occurs when database operations occur, such as checkpoint or
-- subscribe query notification.

EXEC SP_TRACE_SETEVENT @TraceID, 178, 1, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 6, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 7, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 8, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 10, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 11, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 12, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 14, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 23, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 26, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 28, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 34, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 35, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 37, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 40, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 41, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 60, @on
EXEC SP_TRACE_SETEVENT @TraceID, 178, 64, @on

-- Set the Filters.
DECLARE @intfilter INT
DECLARE @bigintfilter bigint

-- Set the trace status to start.
EXEC SP_TRACE_SETSTATUS @TraceID, 1

-- Display trace ID for future references.
SELECT TraceID = @TraceID
GOTO Finish

Error:
SELECT ErrorCode = @rc

Finish:
GO

EXEC SP_PROCOPTION 'fso_audit', 'startup', 'true'
GO

Note: Replace ['d:\sqlserver\audit\fsoauditlog.log'] with the PATH and file name to your audit file.